JetBrains Space Help

Active Directory Auth Module

Active Directory authentication module lets users log in to Space with credentials that are stored in an external directory service. This authentication module is pre-configured for Microsoft Active Directory. You can configure a module to use the standard LDAP scheme or LDAPS over SSL.

The Active Directory authentication module does not import all of the user accounts from the directory service. Space only creates a user account when an unregistered user first logs in to Space.

When Active Directory authentication is enabled, Space checks the directory service for each login attempt. Users who have been removed from the directory service cannot log in to Space.

Prerequisites

If you want to connect to the directory service over SSL, import the trusted SSL certificate for your Active Directory service before you enable the authentication module. If there are any intermediate certificates that sit between the SSL certificate and the root CA certificate, you need to upload a file that contains the full certificate chain.

The option to import a trusted SSL certificate is not supported in the settings for the Active Directory authentication module. Instead, you need to access the Trusted SSL Certificates page and import it there.

For more information, see Trusted SSL Certificates.

Enable Active Directory Authentication

To allow users stored in Microsoft Active Directory to log in to Space, enable an Active Directory authentication module.

To enable Active Directory authentication:

  1. On the main menu, click administration.png Administration and choose Auth Modules.

  2. Click New auth module. The New Auth Module dialog opens

  3. From the Type drop-down list, select Active Directory.

  4. In the New Auth Module dialog, enter values for the following settings:

    Setting

    Description

    Status

    Choose Active to enable the module.

    Key

    Give this authentication module a unique identifier.

    Name

    Give this authentication module a human-readable name to distinguish this module from other authentication modules in the Auth Modules list.

    Server URL

    Stores the LDAP URL of the directory service used to authenticate a login request in Space.

    The LDAP URL uses the format ldap://host:port/DN. Enter the full distinguished name (DN) of the directory where user accounts are stored.

    SSL keystore

    Choose a custom SSL keystore for LDAPS connections.

    Bind DN

    Stores the value that is used to bind with the directory service.

    Bind password

    The password of the Bind account.

    Filter

    TStores an expression that locates the record for a specific user in the LDAP service. The substitution variable in the expression is replaced with the value entered as the username or email on the login page.

    Connection timeout

    Sets the period of time to wait to establish a connection to the authorization service. The default setting is 5000 milliseconds (5 seconds).

    Read timeout

    Sets the period of time to wait to read and retrieve user profile data from the authorization service. The default setting is 5000 milliseconds (5 seconds).

    LDAP referral

    Choose Follow to allow the authentication module to follow requests from the service to locate additional information in the LDAP directory.

    User registration

    On — Accounts in the Space organization will be created automatically for unregistered users who log in using Active Directory authentication module.

    Off — Active Directory logins will be only available to users who already have an account in the Space organization.

  5. Configure the Attribute Mapping.

    When Space finds a record in the LDAP service that matches a filter, it fetches values from the LDAP attributes that are specified for each field and copies them to the user profile in Space. Use the following settings to define the filter criteria and map attributes that are stored in your directory service to user accounts in Space.

    Field

    Description

    Login

    Required. Maps to the LDAP attribute that stores the value to copy to the Login field in the Space profile. For Active Directory, the default value is sAMAccountName.

    Full name

    Maps to the LDAP attribute that stores the value to copy to the Full name field in the Space profile.

    Email

    Maps to the LDAP attribute that stores the value to copy to the Email field in the Space profile.

    Groups

    memberOf

Test the Connection to your Active Directory Service

To verify that the Active Directory authentication module is connected to your Active Directory service, test the connection.

To test the connection:

  1. Click the Test Login button.

  2. In the Test Settings dialog, enter the credentials of a user who is stored in your Active Directory service:

    • In the Login field, enter the domainusername.

    • In the Password field, enter the password.

  3. Click the Test Login button.

    • Space searches for the specified user account in the Active Directory service. If the user is found, a success notification is displayed. If you get an error, check your user credentials and server URL.

Last modified: 07 July 2023